Description
Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php.
References
- 24291 vdb-entry
- http://evuln.com/vulns/113/description.html
- 17335 vdb-entry
- 19479 third-party-advisory
- qlnews-config-file-include(25548) vdb-entry
- 20060412 [eVuln] QLnews XSS and PHP Code Insertion Vulnerabilities mailing-list